What is the CVSS score of CVE-2026-25571?

CVE-2026-25571 has a CVSS 3.1 base score of 5.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Sicam Siapp Sdk are affected by CVE-2026-25571?

Organizations using variables should be aware of moderate risk from CVE-2026-25571 rated CVSS 5.1. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-25571?

Within 30 days: Identify affected systems running variables and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Sicam Siapp Sdk CVE-2026-25571

MEDIUM

Improper Handling of Length Parameter Inconsistency (CWE-130)

2026-03-10 productcert@siemens.com

Denial Of Service Sicam Siapp Sdk

5.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:18 nvd

MEDIUM 5.1

DescriptionCVE.org

A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The SICAM SIAPP SDK client component does not enforce maximum length checks on certain variables before use. This could allow an attacker to send an oversized input that could trigger a stack overflow crashing the process and potentially causing denial of service.

AnalysisAI

Stack overflow in SICAM SIAPP SDK versions below 2.1.7 results from missing input length validation on client-side variables, allowing local attackers to trigger denial of service by submitting oversized inputs that crash the affected process. The vulnerability requires local access and manual user interaction but carries no availability impact mitigation since no patch is currently available.

Technical ContextAI

has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The SICAM SIAPP SDK client component does not enforce maximum length checks on certain variables before use. This could allow an attacker to send an oversized input that could trigger a stack overflow crashing the process and potentially causing denial of service.